Read the docs
TI-2026-22577 Aliases CVE-2026-28265GHSA-669m-x2jm-gm59

Path traversal in Dell PowerStore

Priority LOW 30CWE-35Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00121 1st percentileScored 2026-11-07
Fix Fixed PowerStore (Dell): 4.4.0.0-2692403 or laterPowerStore 500T (Dell): 4.4.0.0-2692403 or later+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellPowerStorebefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 500Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 1000Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 1200Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 3000Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 3200Qbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 3200Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 5000Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 5200Qbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 5200Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 7000Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 9000Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
DellPowerStore 9200Tbefore 4.4.0.0-2692403 or later4.4.0.0-2692403 or laterPatch availableCNA
  • PowerStore VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 500T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 1000T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 1200T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 3000T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 3200Q VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 3200T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 5000T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 5200Q VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 5200T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 7000T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 9000T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA
  • PowerStore 9200T VendorDell Affected before 4.4.0.0-2692403 or later Fixed in 4.4.0.0-2692403 or later Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:*4.3.0.0 to before 4.3.1.1VulnerableDell
cpe:2.3:h:dell:powerstore_1000t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_1200t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_3000t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_3200q:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_3200t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_5000t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_500t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_5200q:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_5200t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:* Versions 4.3.0.0 to before 4.3.1.1 Vulnerable ·Dell
  • cpe:2.3:h:dell:powerstore_1000t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_1200t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_3000t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_3200q:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_3200t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_5000t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_500t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_5200q:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_5200t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:dell:powerstore_7000t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_9000t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:powerstore_9200t:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:h:dell:powerstore_7000t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_9000t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:powerstore_9200t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA PowerStore (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 500T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 1000T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 1200T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 3000T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 3200Q (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 3200T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 5000T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 5200Q (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 5200T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 7000T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 9000T (Dell) Fixed in 4.4.0.0-2692403 or later
  • Fix · CNA PowerStore 9200T (Dell) Fixed in 4.4.0.0-2692403 or later

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28265
  2. 2026-10-03 Alias added: GHSA-669m-x2jm-gm59

References

Advisory 1

  • TI-2026-42160 Missing authentication in Dell PowerStore 500T CVSS 3.1CRITICAL 9.8
  • TI-2022-10113 Information disclosure in Dell PowerStore CVSS 3.1CRITICAL 9.8
  • TI-2026-55184 Missing authentication in Dell PowerStore 500T CVSS 3.1CRITICAL 10.0
  • TI-2022-10114 Authentication bypass in Dell PowerStore CVSS 3.1CRITICAL 9.8
  • TI-2026-55183 Protection mechanism failure in Dell PowerStore 500T CVSS 3.1HIGH 8.8
  • TI-2026-55181 Protection mechanism failure in Dell PowerStore 500T CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences